My MCP Tool Fetches Before It Writes and Logs Every Change. It Never Checked Whether There Was Anything to Change.
Two fixes ago, update_article — one of the tools in this repo's MCP server — got hardened twice. The first time, because it took a bare integer article_id , PUT whatever fields you gave it straight to the DEV.to API, and if the id was wrong it would silently overwrite a live published post with nothing left behind to prove it happened. That fix added a fetch-before-write step and a JSONL audit…
The MCP tool, part of a repository's MCP server, experienced two bug fixes. Initially, it sent empty data to the DEV.to API when provided with bare integers for article_id, overwriting live posts without leaving any trace. The second fix recorded a hardcoded diff regardless of actual changes, causing the log to show "nothing changed" even when the body_markdown was edited.
Both fixes failed to verify if any changes were made at all. The function signature, def update_article(article_id:int, title:str=None, body_markdown:str=None, published:bool=None) -> dict, defaults parameters to None, allowing updates to just the title without sending the entire body. However, this design flaw meant the function wouldn't short-circuit if all parameters were None.
Calling update_article(article_id=123) would fetch the current article, PUT an empty {article:{}} to the live post, and log the result as if meaningful changes occurred. This identical issue could arise from passing incorrect argument names or leaving the function to handle no-op scenarios inadvertently. The solution was to implement a check before making any changes, ensuring that at least one of title, body_markdown, or published is provided.
While the server-side handling of an empty article object was unclear, the client-side bug was confirmed as reproducible and independent of server error handling.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written; read the original for the full account.
